a97caeea5750215ce3f795d9e309e43ae4afa66ca3092e172ce66688996f0b29

Analysis

max time kernel
121s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data/OFFLINE/5EC33410/1511F90F/Pitch Pedal Factory.ngrc
Size

45KB
MD5

2fbe7612416b9e6bd89b81f2bc1bbbbf
SHA1

805b83bc24813d0b3c6c81690c59ff6793d05c92
SHA256

72e2ca2df8db05b69c5b0c8a5e6bc78eba60dc85ec2fc660c9aca8735c32c768
SHA512

2350eada1ce937aca2a235f1ba1f97bdbd24fc4c14f250d3838ed8c5687487ad2f18c306de4fc40dd78eb1bcaf85dfa36578bd39105a486591837f0c55c50d8a
SSDEEP

96:uPTbfA93A7lggP7CjgW0gW75gWWlgWf6gW3ygW16gWp6gWZ5gWZJLJXgz72jgWHF:GMaM9pYIK2BU6TDGwYAUDs5zeqU

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.ngrc\ = "ngrc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\ngrc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\ngrc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\ngrc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.ngrc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\ngrc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\ngrc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\ngrc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2280	2636	cmd.exe	32
PID 2636 wrote to memory of 2280	2636	cmd.exe	32
PID 2636 wrote to memory of 2280	2636	cmd.exe	32
PID 2280 wrote to memory of 2660	2280	rundll32.exe	33
PID 2280 wrote to memory of 2660	2280	rundll32.exe	33
PID 2280 wrote to memory of 2660	2280	rundll32.exe	33
PID 2280 wrote to memory of 2660	2280	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\1511F90F\Pitch Pedal Factory.ngrc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\1511F90F\Pitch Pedal Factory.ngrc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\OFFLINE\5EC33410\1511F90F\Pitch Pedal Factory.ngrc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
01951d56d7f9425a47cd138fd21f3036

SHA1
b0f76aacff67d7b40bfbf2bf6cab22b92527bae1

SHA256
32975af6eeacc6442096c2cfc2f549ade4782cb66b13dfb6b685a14c665db804

SHA512
8ffd63585185d05c820427be6d2fd401d53d0a2228092ae1825b80e8cdd757a1f83edc8bdde463f4a412ae00da179a6b650c3cd7ce2ed794417a9299b01ff11a

Download Submit